Release Secant v0.1.0

Part of #2.

Question

What does Secant's first public release, v0.1.0, still need, now that M6 closed with a validated non-publishing candidate and G4 (#233) found no engineering work between here and the release?

This is a human-only Task. It clears the ADR 0028 public-use gates, tags v0.1.0 on the chosen main commit, re-records the digest-bound human evidence against that tagged candidate, and approves the protected release environment so the promote job publishes the npm packages and the GitHub release. No spec, tickets, or audit follow from it. #38 and #39 are picked from this map only after this release is live.

Starting context

Files are pinned at d0b49918766959c7fa3e2cad3674e70405c23ad1. The G4 docs commit lands after this pin and changes no source; tag the main head that exists when step 3 runs.

Input	Why it matters	Authority
ADR 0028, Gates before public use	The four public-use gates. The npm identity gate is satisfied (`@secantdev/secant` reserved, authenticated dry-run passed in the M6 candidate); trademark clearance, the website decision, and the native-speaker checks are still unrecorded	Canonical
ADR 0027	One installed-Harness run per Harness and the Windows Terminal report per release, each bound to the candidate binary's SHA-256. The first release always requires fresh Windows Terminal evidence (`windowsTerminalTrigger` with no previous tag)	Canonical
Release workflow policy	A `v*` tag reruns the whole gate on its commit; `release-approval` admits the tag only when it exactly equals the package version and prints the approval summary with the Shipped Bundles line; `promote` runs only behind the protected `release` environment and publishes npm then the GitHub release	Canonical
Release checklist and release-check instructions	The template to fill for a `release` candidate kind, and the three human checks (`check:windows-terminal`, `check:claude-code`, `check:codex`)	Canonical
#229 approved M6 checklist	The worked precedent: a filled checklist and digest-bound reports posted as comments. Its reports bind to commit `6959599` and cannot be carried to the tagged candidate	Advisory
Support matrix	Rows to refresh from the tagged candidate's reports; legacy conhost stays unclaimed	Current fact
`package.json`	Version `0.1.0`; the tag must equal it exactly, so no bump commit is needed	Current fact

Reading rule. Do the steps in order; each later step binds to the earlier one's output.

ADR 0028 gates. Record professional trademark clearance for the launch jurisdictions, the website decision (registrar confirmation for secant.sh or an explicit "not wanted"), and a native-speaker check per launch market, as comments here. Public use stays blocked until all three exist.
Choose the commit. The main head at that moment, green on the three-OS push gate. No source change is expected before the tag.
Tag. Push v0.1.0 on that commit. CI reruns the whole gate, assembles the candidate once, and release-approval prints the approval summary; take the candidate digests and the Shipped Bundles line from it.
Fresh human evidence. Against the downloaded tagged binary: check:windows-terminal (fresh, first release), check:claude-code and check:codex against the External Test Repair Proof Bundle, plus the headless no-notice observation. Post each report here. This step needs a Windows machine with both Harnesses installed.
Approve and promote. Fill the checklist copy with candidate kind release, refresh the support-matrix rows the new reports prove in a signed commit, then approve the protected release environment. promote publishes the platform packages, the launcher, and the GitHub release. Record the final URLs here and close.

Owner: Human release operator.
Ratchet: One tagged candidate, bound to fresh Windows Terminal, installed Claude Code and Codex reports, a filled release checklist, and recorded ADR 0028 evidence.
Deletes: Support-matrix citations the tagged candidate's reports supersede.
Gate: ADR 0027 three-OS CI plus recorded human evidence, and the protected release environment.
Dependencies: Trademark counsel and native-speaker access, a Windows machine with Windows Terminal and both Harnesses, the NPM_PUBLISH_TOKEN secret in the release environment; no product dependency.

Pre-tag check (2026-09-26)

Checked the repo state against the Starting context before step 3.

Blocker: the release environment does not exist. GET /repos/secantdev/secant/environments returns total_count: 0, and there is no NPM_PUBLISH_TOKEN at any scope. The only repo secret is NPM_READONLY_TOKEN. Release workflow policy says both are "configured out of band", but that configuration never happened. If v0.1.0 is pushed now, GitHub auto-creates release with no protection rules. promote then runs without the approval pause and fails when it tries to publish, and the tag is spent. checkReleaseProtection only looks at the workflow file, so it can't catch this.
Fix before step 3 (repo admin, Settings → Environments): create release, add Rohan as the sole required reviewer, restrict deployments to v* tags, and add NPM_PUBLISH_TOKEN as an environment secret. Use an npm automation or granular token with publish rights on @secantdev.
main head 41daa9d (docs: complete G4 guidance review) is green on the push Check run. It is the step-2 candidate unless main moves first.
No v* tag exists yet. package.json is 0.1.0.
ADR 0028 gates 1, 3 and 4 (trademark clearance, the secant.sh decision, native-speaker checks) are still unrecorded on this ticket.

Pre-tag blocker resolved (2026-09-26)

The release environment is now configured. Checked with gh api:

release exists. Its required reviewer is Sandstorm831 (Rohan) alone. Prevent self-review is off, so Rohan can approve a run started by his own tag push.
Admin bypass is off (can_admins_bypass: false).
Deployments are allowed only from refs matching the tag pattern v*. No branches are allowed.
NPM_PUBLISH_TOKEN is an environment secret. It is not a repo secret; the only repo secret is NPM_READONLY_TOKEN. Org-level secrets were not checked: the session lacked permission (HTTP 403).

Still open before step 3: the ADR 0028 gates (trademark clearance, the secant.sh decision, native-speaker checks).

Step 1: ADR 0028 gates recorded (2026-09-26)

Recorded in ADR 0028's 2026-09-26 amendment, in commit 8b14357:

Gate 2, npm identity: still satisfied. @secantdev/secant is reserved, and the authenticated dry-run passed in the M6 candidate.
Gate 3, website: met. secant.sh is registered and serves the project site (checked: HTTP 200).
Gates 1 and 4, trademark clearance and native-speaker checks: waived by the maintainer, not met. Secant is an open-source tool and no company is registered anywhere. At the current audience, these checks cost more than the risk they would remove. Trademark status stays unknown, and the project claims no exclusive ownership of the name. The amendment lists the triggers for revisiting them: a commercial offering, a company registration, a trademark filing, or a conflict someone raises.

The release checklist now accepts a recorded waiver for gates 1 and 4. Next is step 2: tag 8b14357 once the three-OS push Check run on it is green.

Step 3: tagged candidate identity (2026-09-26)

Tag: v0.1.0, a lightweight tag on commit 8b14357645b5a712c96c8bda24dfe596c9f9c2d6
Workflow run: Check run 36236727413 (tag push). check (all three OSes), build, all three consumer jobs, and release-approval succeeded. promote is waiting for review.
Secant version: 0.1.0. release-approval confirmed that the tag matches the version.
Windows Terminal trigger: first release, so fresh evidence is required.

Candidate digests

Artifact	SHA-256
Windows x64 archive	`4a48722b13c08bde8c418b5d17cbd1ce8ad1d51107db99a86321e25afd02cdcf`
Windows x64 binary	`c1fab9956073b39ab689793f0a4232260986c521b98106fb28a9bd296ffa9577`
macOS arm64 archive	`f8313892b7bdf65f29e39b4fb4add17fc4d25b5d6c32caa067773c67dc3c7283`
macOS arm64 binary	`5344316ddd7ca6a82b5ab0268382edcab03afbd739382fd4f4ac0e379a5b685a`
Linux x64 archive	`0e413177c841436839357185a4e1823694361ccb7fbbb9bf87cc3d836e192e3e`
Linux x64 binary	`5887fcd386d3e4a8f6ca1e13f0848feafc1d66be08faf7685ca4b33db9b74712`
`@secantdev/secant-windows-x64` tarball	`e264970d843673419b60635c7066d822116d277c3f827b37a72e952e1446b7b4`
`@secantdev/secant-darwin-arm64` tarball	`12da7bdef694ae7f5bf65e9084a05e9b922cd4852a284d5bca5e5e1c3793a295`
`@secantdev/secant-linux-x64` tarball	`9799d400a3312d91c85731f58d46a076cc96d456400738c1839cd1a96ff79109`
`@secantdev/secant` launcher tarball	`934afa590266414bca1f78cd257924c1d86b96535057f197f8217e043276d23e`
LICENSE	`b5d491fb2211b6656f238e0a6763f23a3ae975f0b0726b336ff9e1309178008a`
THIRD-PARTY-NOTICES.md	`dfdefe5aa2f1628fa75810b14ae282b1e9bbdab777c062dd573f6599dcfc04f0`

Shipped Bundles, in the approval-summary format: dev.secant.matt-front@2.6.0: 8be515e88f5c91859903052b02f63dcc4cf399105ef82ec6e5358cdb2106e08a

Independent verification. I downloaded all three artifacts from the run and re-hashed them myself:

The archives pass sha256sum -c SHA256SUMS.
Each raw binary matches candidate-manifest.json, package-manifest.json, and the approval summary.
Each binary extracted from its archive, and from its npm tarball, has the same hash as the raw binary.
The LICENSE and notices files inside every archive and tarball match the manifest hashes.
On npm, @secantdev/secant has only 0.0.0, and the three platform packages do not exist yet. promote will publish all four as new versions.

The binary and npm tarball bytes are identical to the M6 candidate's (#229). Only docs changed after 6959599, so the build is reproducible. Only the archive hashes differ. The M6 reports are still bound to a different commit and run, so the fresh step-4 reports are required.

Claude Code installed-Harness Proof Bundle check

Check name: Claude Code installed-Harness Proof Bundle check
OS and version: Windows Windows 11 Home Single Language (10.0.26200)
Harness: claude-code 2.1.283 (Claude Code)
Bun version: 1.4.2
Secant version: 0.1.0
Binary SHA-256: c1fab9956073b39ab689793f0a4232260986c521b98106fb28a9bd296ffa9577
Outcome: pass
UTC timestamp: 2026-09-26T11:43:00.014Z
Headless conhost notice: none; this check opened no Secant TUI or conhost window.

External Proof Bundle observations

Observation	Result
Test repair	pass
Authored approve-commit gate	pass
Commit absent before approval	pass
Run succeeded after approval	pass
Post-approval commit	pass

Candidate: Check run 36236727413, tag v0.1.0, commit 8b14357645b5a712c96c8bda24dfe596c9f9c2d6. The downloaded secant-windows-x64.exe SHA-256 matches candidate-manifest.json. The Proof Bundle was built by this binary from bundles/test-repair-workflow at the tag: dev.secant.test-repair@1.0.0, digest sha256:501d11d1b2af964b35185eb1b18249ad660613ea97ed6f6e892a6e07b050dc07. Repair commit 387e768 sits on baseline d9a718b in the disposable workspace.

Codex installed-Harness Proof Bundle check

Check name: Codex installed-Harness Proof Bundle check
OS and version: Windows Windows 11 Home Single Language (10.0.26200)
Harness: codex codex-cli 0.155.0
Bun version: 1.4.2
Secant version: 0.1.0
Binary SHA-256: c1fab9956073b39ab689793f0a4232260986c521b98106fb28a9bd296ffa9577
Outcome: pass
UTC timestamp: 2026-09-26T11:46:50.561Z
Headless conhost notice: none; this check opened no Secant TUI or conhost window.

External Proof Bundle observations

Observation	Result
Test repair	pass
Authored approve-commit gate	pass
Commit absent before approval	pass
Run succeeded after approval	pass
Post-approval commit	pass

Candidate: Check run 36236727413, tag v0.1.0, commit 8b14357645b5a712c96c8bda24dfe596c9f9c2d6. The downloaded secant-windows-x64.exe SHA-256 matches candidate-manifest.json, and the Proof Bundle is the same one used for the Claude Code check (sha256:501d11d1…050dc07). Repair commit d11578d sits on baseline 9c3296f in a fresh disposable workspace.

An earlier attempt at 11:43:51Z failed because Codex's ChatGPT login on this machine had been revoked: codex exec alone returned 401 refresh_token_invalidated. That run made no commit. It passed after re-login in a fresh workspace, with the same binary and Bundle. That failure is not candidate evidence.

Headless no-notice check

OS and version: Windows 11 Home Single Language (10.0.26200)
Binary: downloaded secant-windows-x64.exe from Check run 36236727413, SHA-256 c1fab9956073b39ab689793f0a4232260986c521b98106fb28a9bd296ffa9577
Isolated SECANT_HOME
secant --version exited 0 and printed 0.1.0. secant bundle list --json exited 0 and printed the bundle-catalog family.
Combined stderr from both commands: 0 bytes. No legacy-conhost notice was printed.
Neither installed-Harness check opened a Secant TUI or conhost window (both reports above).

Windows Terminal human real-terminal check

Check name: Windows Terminal human real-terminal check
OS and version: Windows Windows 11 Home Single Language (10.0.26200)
Terminal: Windows Terminal 1.24.11911.0
Bun version: 1.4.2
Secant version: 0.1.0
Binary SHA-256: c1fab9956073b39ab689793f0a4232260986c521b98106fb28a9bd296ffa9577
Outcome: pass
UTC timestamp: 2026-09-26T11:51:01.536Z
Evidence basis: fresh real-terminal check

Host	Exit path	Observation	Result
Windows Terminal	quit binding (q)	Key delivered, shell exited, and terminal remained responsive	pass
Windows Terminal	Ctrl+C	Key delivered, shell exited, and terminal remained responsive	pass
legacy conhost (observed only; does not decide outcome)	quit binding (q)	Startup notice appeared	yes
legacy conhost (observed only; does not decide outcome)	startup	Notice read and a key pressed before TUI takeover	yes
legacy conhost (observed only; does not decide outcome)	quit binding (q)	Window survived and remained responsive	no

Candidate: Check run 36236727413, tag v0.1.0, commit 8b14357645b5a712c96c8bda24dfe596c9f9c2d6. Run against the downloaded secant-windows-x64.exe, whose SHA-256 matches candidate-manifest.json. Fresh evidence, as the first release requires.

v0.1.0 release checklist

Copied from docs/release-checklist.md. This records the tagged release candidate and the human checks for the protected release approval.

Candidate identity

Ref/tag: v0.1.0
Commit: 8b14357645b5a712c96c8bda24dfe596c9f9c2d6
Workflow run: Check run 36236727413 (tag push)
Secant version: 0.1.0
Candidate digests:
- Windows x64 archive and binary SHA-256: 4a48722b13c08bde8c418b5d17cbd1ce8ad1d51107db99a86321e25afd02cdcf / c1fab9956073b39ab689793f0a4232260986c521b98106fb28a9bd296ffa9577
- macOS arm64 archive and binary SHA-256: f8313892b7bdf65f29e39b4fb4add17fc4d25b5d6c32caa067773c67dc3c7283 / 5344316ddd7ca6a82b5ab0268382edcab03afbd739382fd4f4ac0e379a5b685a
- Linux x64 archive and binary SHA-256: 0e413177c841436839357185a4e1823694361ccb7fbbb9bf87cc3d836e192e3e / 5887fcd386d3e4a8f6ca1e13f0848feafc1d66be08faf7685ca4b33db9b74712
- npm launcher and platform-package digests:
  - @secantdev/secant: 934afa590266414bca1f78cd257924c1d86b96535057f197f8217e043276d23e
  - @secantdev/secant-windows-x64: e264970d843673419b60635c7066d822116d277c3f827b37a72e952e1446b7b4
  - @secantdev/secant-darwin-arm64: 12da7bdef694ae7f5bf65e9084a05e9b922cd4852a284d5bca5e5e1c3793a295
  - @secantdev/secant-linux-x64: 9799d400a3312d91c85731f58d46a076cc96d456400738c1839cd1a96ff79109
Shipped Bundles (approval-summary format): dev.secant.matt-front@2.6.0: 8be515e88f5c91859903052b02f63dcc4cf399105ef82ec6e5358cdb2106e08a

I downloaded the three artifacts and re-hashed them myself (identity comment):

The archives pass SHA256SUMS.
The raw binaries, and the binaries inside each archive and each npm tarball, all match the manifests and the approval summary.

Automated gates

Exact ref/commit/version agreement: release-approval admitted v0.1.0 = 0.1.0 at 8b14357 (job)
Canonical three-OS check: Windows, macOS, Linux
Native compiled-binary smoke: Windows, macOS, Linux
Candidate archive, installer, and npm consumer checks: every consumer scenario passed in the three consumer jobs above
Signature and candidate checksum verification: passed in the consumer jobs, and in the independent re-hash above
Authenticated read-only npm identity and publish dry-runs, carried forward over identical bytes. By design, the dry-run step runs only on workflow_dispatch, so it was skipped on this tag run. All four npm tarballs here are byte-identical to the M6 candidate's, which passed the authenticated dry-run in run 36093685185's build job.
Artifact-level licence and third-party-notices gate: passed in this run's build job. The LICENSE and notices digests match in every archive and tarball.
Gate evidence: Check run 36236727413

Human reports

Installed Claude Code report attached; candidate binary SHA-256 matches
Installed Codex report attached; candidate binary SHA-256 matches
Windows Terminal trigger decision recorded: fresh evidence required (first release, no previous tag)
Legacy-conhost notice observation recorded (observed only; not a support claim): the notice appeared and was readable before a keypress, and the window did not survive quit. The same as M6.
Claude Code report: Claude Code 2.1.283 pass
Codex report: Codex 0.155.0 pass. An earlier attempt failed because Codex's own login had been revoked. It is noted in the report and is not candidate evidence.
Windows Terminal basis: fresh Windows Terminal 1.24.11911.0 pass, binary SHA-256 c1fab9956073b39ab689793f0a4232260986c521b98106fb28a9bd296ffa9577
Named carry-forward comparison: n/a; fresh evidence
Headless notice: digest-bound headless CLI check. It captured 0 bytes of stderr, and neither Harness check opened a TUI or conhost window.

Recording/replay is deterministic Adapter evidence only. It does not fill an installed-Harness report, real-terminal report, or three-OS native-binary row.

Claims and public-use gates

docs/support-matrix.md OS/architecture claims cite this run's native binary evidence
Terminal claims cite the fresh real-terminal report above
Harness claims cite the matching real installed-Harness reports and versions
No replay result is cited as real-Harness or three-OS evidence
ADR 0028 trademark clearance: waived by the 2026-09-26 amendment, which still stands
ADR 0028 npm/package-identity gate remains satisfied: @secantdev/secant is reserved, and the platform packages are not yet registered
ADR 0028 website decision: secant.sh is registered and serves the project site
ADR 0028 launch-market native-speaker checks: waived by the same amendment, which still stands
Support-matrix change: 360976d (signed, verified)
Public-use evidence: step 1 record

Approval

Candidate kind: release
Final reviewer: Sandstorm831 (Rohan Garg)
Protected-environment approval: approved by Sandstorm831 with the comment "Checklist Release Secant v0.1.0 #234 reviewed" on run 36236727413 (deployment 6677928649). The promote job succeeded.
Approval UTC timestamp: 2026-09-26T11:56:59Z, when promote started after the approval
Reviewer confirmed every report and claim is bound to the ref, commit, workflow run, version, and digests above

Resolution: Secant v0.1.0 is released (2026-09-26)

Released:

npm: @secantdev/secant@0.1.0, plus the platform packages @secantdev/secant-windows-x64, @secantdev/secant-darwin-arm64, and @secantdev/secant-linux-x64
GitHub release: v0.1.0, published 2026-09-26T11:57:44Z, with the three archives, SHA256SUMS, and candidate-manifest.json
Promotion: promote job in Check run 36236727413, approved by Sandstorm831 on the protected release environment

Post-release verification:

Each registry tarball fetched with npm pack has the same SHA-256 as package-manifest.json and launcher-manifest.json, so the published bytes are the approved candidate.
The published SHA256SUMS matches the candidate archive digests.
A fresh npm install @secantdev/secant@0.1.0 on Windows 11, followed by npx secant --version, prints 0.1.0.

What this ticket settled:

The release environment had never been configured. It is now set up: sole reviewer Sandstorm831, admin bypass off, v* tags only, and NPM_PUBLISH_TOKEN as an environment secret (check).
ADR 0028 gates: npm identity and website are met. Trademark clearance and the native-speaker checks are waived by the 2026-09-26 amendment, with named triggers for revisiting them.
Tag: v0.1.0 on 8b14357 (identity).
Fresh evidence, all against binary c1fab995…a9577: Claude Code 2.1.283, Codex 0.155.0, headless, and Windows Terminal 1.24.11911.0.
Support matrix refreshed in signed commit 360976d. Checklist filled, and the release approved and promoted.

Follow-ups, not yet ticketed:

Move npm publishing to Trusted Publisher (OIDC) now that all four packages exist, and retire NPM_PUBLISH_TOKEN.
Secant reported a Codex login failure (401 refresh_token_invalidated) as a bare failed agent Turn, with no problem code or remediation. An expired Harness login should surface as a typed problem.
The candidate-validation npm dry-run runs only on workflow_dispatch. This release carried it forward over byte-identical tarballs.

Navigation Menu

Repository navigation

Release Secant v0.1.0 #234

Question

Starting context

Pre-tag check (2026-09-26)

Pre-tag blocker resolved (2026-09-26)

Step 1: ADR 0028 gates recorded (2026-09-26)

Step 3: tagged candidate identity (2026-09-26)

Claude Code installed-Harness Proof Bundle check

External Proof Bundle observations

Codex installed-Harness Proof Bundle check

External Proof Bundle observations

Headless no-notice check

Windows Terminal human real-terminal check

v0.1.0 release checklist

Candidate identity

Automated gates

Human reports

Claims and public-use gates

Approval

Resolution: Secant v0.1.0 is released (2026-09-26)

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Release Secant v0.1.0 #234

Description

Question

Activity

Sandstorm831 commented on Sep 26, 2026

Starting context

Sandstorm831 commented on Sep 26, 2026

Pre-tag check (2026-09-26)

Sandstorm831 commented on Sep 26, 2026

Pre-tag blocker resolved (2026-09-26)

Sandstorm831 commented on Sep 26, 2026

Step 1: ADR 0028 gates recorded (2026-09-26)

Sandstorm831 commented on Sep 26, 2026

Step 3: tagged candidate identity (2026-09-26)

Sandstorm831 commented on Sep 26, 2026

Claude Code installed-Harness Proof Bundle check

External Proof Bundle observations

Sandstorm831 commented on Sep 26, 2026

Codex installed-Harness Proof Bundle check

External Proof Bundle observations

Sandstorm831 commented on Sep 26, 2026

Headless no-notice check

Sandstorm831 commented on Sep 26, 2026

Windows Terminal human real-terminal check

Sandstorm831 commented on Sep 26, 2026

v0.1.0 release checklist

Candidate identity

Automated gates

Human reports

Claims and public-use gates

Approval

Sandstorm831 commented on Sep 26, 2026

Resolution: Secant v0.1.0 is released (2026-09-26)

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions